Get the actual ciphertext "sha512"
So I am developing a site using php, mysql and javascript and also 'sha512' to encrypt member passwords using the code:
$password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
$random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));
$password = hash('sha512', $password . $random_salt);
The value p
starts with:
function formhash(form) {
var password = randomString();
var p = document.createElement("input");
form.appendChild(p);
p.name = "p";
p.type = "hidden";
p.value = hex_sha512(password.value);
password.value = "";
form.submit();
}
function randomString() {
var text = "";
var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
for( var i=0; i < 9; i++ )
text += possible.charAt(Math.floor(Math.random() * possible.length));
return text;
}
My idea here is to reset the user's password by entering their email and generating a random 8 characters and then sending them directly to their email. The problem I am facing now is getting the actual password (not encrypted) that was generated so that it can be automatically sent to the email address of the member who requested to reset their password?
source to share
First, you should never send your passwords to users in clear text.He considered poor security practice for several reasons. If anyone gains access to email, they have a password and can lock the user account. Second, hashing is a one-way form of encryption in which you turn the password into gibberish. The great thing about hashing is that the same password will always turn into the same gibberish - every time. This means you can search for passwords without storing the raw password. The reason you should provide a password rather than doing two-way encryption like AES-256 is because two-way encryption requires creating, managing, and protecting encryption keys, which can be difficult. Hashing is simply easier and safer for the vast majority of developers.
So how are you supposed to implement a password reset if you can't send the raw password? You send an email to the user with a link to a secure reset page AND a one-time reset token that expires on a specific window. Thus, if someone gains access to the email, then the risk window is limited to a short window.
There are many ways to create this yourself, but a simple approach to getting a one-time token that you don't need to store or manage is to turn off user management down to a microservice like Stormpath where it takes care of all user management for you - password reset, store passwords , user profiles, authentication, etc.
For a password reset, this is how it would look:
User initiates password reset works on web page
- You are calling the API for the assault route with the user's email address or username
- Stormpath sends a reset email address to the user (your "from" address, custom HTML, etc.) with a link + token. A reset character, which is unique, one-time, and ends if not used for 24 hours.
- User clicks on link and lands on reset page
- You pull the token from the url and check the Stormpath to validate the token.
- User sends a new password
- Stormpath sends a reset success message (your "from" address, custom HTML, etc.)
You can create custom UIs on this thread so that the user never knows the Stormpath exists.
Now you don't need to manage, store or protect passwords or reset tags in your database.
Here are some links to the community driven PHP SDK.
http://docs.stormpath.com/php/quickstart/
http://docs.stormpath.com/php/product-guide/
Full disclosure - I work at Stormpath
source to share
and also 'sha512' for password encryption
You are not encrypting them, you are hashing them. Hash is a one way function. You cannot take the result of a hash function and get the original. There are many possible raw chunks of data that could result in the same hash.
The whole point of hashing in this context is to be able to validate passwords without even storing the user's password. You should not send your password to the user by email, as email is sent over the Internet unencrypted. If for some reason you must have the original pre-hashed data, you should save it before you do it.
source to share